Skip to content
Search
paperAugust 2026Unreviewed

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea, Kaushal Punjabi, Stjepan Picek

View resourcePDF

Abstract

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely primarily on Android accessibility (A11y) trees and secondarily on visual screenshots. In this paper, we demonstrate that this architectural dependence on unsanitized accessibility metadata, together with visu

Categories

Prompt Injection

Framework mappings

OWASP Top 10 for LLM Applications
  • LLM01Prompt Injection
MITRE ATLAS
  • AML.T0051LLM Prompt Injection

Suggested from the entry's categories.

Cite

@misc{deivasigamani2026not,
  title = {{Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection}},
  author = {Rahul Deivasigamani and Sayeda Faatin Alvi and Derqui Andrea and Kaushal Punjabi and Stjepan Picek},
  year = {2026},
  month = aug,
  eprint = {2608.08939},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08939}
}